Regulations
Built on India's DPDP Act. Ready for GDPR and CCPA.
One platform answers three privacy laws and India's sector regulators, each with its own clocks, notices and evidence.
Pick a section. See what FOCTTA does for it.
Each section of the DPDP ActDPDP Act (Digital Personal Data Protection Act, 2023): India's law on how organisations collect and use personal data, and the rights people have over it. sets a duty. Pick one to see what the law asks and how FOCTTA helps.
S.5 · Notice
The Act asks: An itemised notice before or with the consent request, with how to withdraw and complain.
Versioned notices that cannot publish without the complaint route.
Every consent stamped with the notice in force
Served by country, language and brand
Re-consent when the notice changes
S.6 · Consent
The Act asks: Free, specific, informed and unambiguous consent, and withdrawal as easy as giving it.
A consent ledger that proves yes, proves no, and enforces withdrawal.
One record per person, purpose and business unit
Refusals recorded as evidence
Withdrawal applied on every server at once
S.7 · Legitimate uses
The Act asks: Processing without consent only for the uses the Act lists.
The lawful basis is on every record, and the DPIA reads it.
Deemed consent and legitimate uses recorded as the basis
Assessments conclude from the recorded basis, never a guess
S.8(2) · Processors
The Act asks: Processors engaged only under a valid contract.
Sharing consent is refused without an active processing contract (DPA).
Processor register with DPA status and expiry
Alerts at 180, 90, 60, 30, 14 and 0 days
DPA clause checklist
S.8(6) · Personal data breach
The Act asks: Inform the Board and each affected person of a breach.
Parallel regulator clocks from the moment you know.
CERT-In, RBI, SEBI 6h; IRDAI copy; Board from May 2027
Blast radius matched to your data map
Board breach report and a drafted action plan
S.8(7) · Erasure
The Act asks: Erase when consent is withdrawn or the purpose is served, unless law requires retention.
A legal decision tree for every system, with a certificate.
Retention reasons from a catalogue of 11 laws
Legal hold respected
Processors confirm erasure by secure link
S.8(8) · Erasing inactive accounts (Third Schedule)
The Act asks: Erase after the prescribed inactivity, with a 48-hour notice first.
The 48-hour notice by WhatsApp, SMS or email, then erasure.
Dormant users found for the Third Schedule classes
Legal hold respected
S.9 · Children's data
The Act asks: Verifiable guardian consent, and no tracking or targeted ads at children.
Tracking blocked for children, even when they tap Accept All.
Child-directed mode and an under-18 choice
Guardian details required and encrypted
Children's data makes a DPIA mandatory
S.10 · Significant Data Fiduciary
The Act asks: A DPO in India, independent audit, periodic DPIA and algorithmic due diligence.
The extra duties of a Significant Data Fiduciary, as one governed chain.
Annual DPIA with the Rule 13(3) step
Auditor attestation and board sign-off
Rule 13(2) submission bundle
S.11 · Right to access
The Act asks: A summary of the data, the processing and who it was shared with.
An access package with India-aware redaction.
No tipping off, Aadhaar and PAN masking
ZIP with manifest, checksums and certificate
S.12 · Correction and erasure
The Act asks: Correct, complete, update or erase on request.
Correction fanned out to every system, with rollback.
Re-KYC routing for hard fields
Correction certificate
S.13 · Grievance redressal
The Act asks: An effective grievance mechanism within the prescribed period.
A 12-state workflow on the 90-day clock.
Public form with 13 categories
Warnings at 50, 75 and 90 percent
Board escalation packet after redressal
S.14 · Right to nominate
The Act asks: Let a person nominate someone to act for them.
Two-party confirmation and a cooling-off hold.
One-time codes for both parties
Waiver only by two different approvers
S.16 · Cross-border transfer
The Act asks: Transfers restricted only to countries the government notifies.
Transfer country and safeguards on every vendor.
Per-vendor transfer records
A cross-border register in the evidence pack, with Discovery
R.14 · Publishing how to exercise rights
The Act asks: Publish how to exercise rights and which identifiers are needed.
A rights portal builder per business unit.
Identifier sets under Rule 14(5)
Identity floors that rise for BFSI and children
S.27 · Complaints to the Board
The Act asks: A person may complain to the Data Protection Board.
The Board complaint link on every banner and notice.
Tamper-evident escalation packet
The person records their Board filing reference
EU · GDPR
GDPR for your EU customers.
The same console that runs your DPDP programme answers people in the EU, with GDPR clocks, notices and clauses.
Fines up to €20 million or 4% of worldwide annual turnover.Notices by locationEU visitors see the GDPR notice in their language.
30-day request clockAnswer EU people's data requests within 30 days.Staff-enteredWith the 60-day extension, and warnings at 50, 75 and 90 percent, on requests your team logs.
Processor contract checks12 contract clauses tracked for each vendor.GDPR Art. 28 · DPA
72-hour breach clockThe GDPR breach deadline, next to the Indian clocks.
Legal grounds for useRecord the legal ground for each use of data.GDPR lawful basesConsent, contract, legal obligation, vital interest, public task and legitimate interest.
Risk assessment templatesReady-made GDPR and multi-law risk assessments.DPIA · TIA
Signed GDPR evidence packA signed bundle of proof for GDPR audits.PilotWith FOCTTA Discovery.
US · CCPA
CCPA and CPRA for your California customers.
Switch CCPA on when you serve California. Notices, service-provider clauses and request clocks sit in the same console as your DPDP programme.
Civil penalties per violation, higher for intentional violations.Notices by locationUS visitors see the CCPA notice.
Service provider contracts8 contract clauses tracked for each service provider.CCPA
45-day request clockAnswer California data requests within 45 days.Staff-enteredWith the 45-day extension, on requests your team logs.
Signed CCPA evidence packA signed bundle of proof for CCPA audits.PilotWith FOCTTA Discovery.
India · Sector
India's sector regulators, built in.
Breach clocks, retention rules and content packs for the regulators your board answers to, and 17 more regulator bundles ready to apply.
From May 2027 these run alongside the DPDP Board duty.Banking regulatorA 6-hour clock for cyber incident reports to RBI.RBI6-hour cyber incident clock on DAKSH (2026 Directions), credit-information correction compensation and BFSI identity floors.
Securities regulator6-hour notice, then a portal report at 24 hours.SEBI CSCRFEvidence pack with Discovery6-hour notice and 24-hour portal report, a signed CSCRF evidence pack and a DR and BCP log.
Insurance regulator6-hour CERT-In report, with a copy to IRDAI.IRDAI6-hour CERT-In report copied to IRDAI, and IRDAI record-retention reasons.
National cyber agency6-hour reporting clock and a ready report bundle.CERT-In
Record-keeping lawsRecords these laws require are kept, not erased.PMLA · Companies Act · taxRetention reasons in the erasure catalogue, and STR details kept out of access packages (no tipping off).
Broadcast and accessibilityBroadcast overlays and a colour contrast check.TRAI · MIB · RPwDBroadcasting overlays and a WCAG AA contrast check that supports RPwD s.46 duties.
Banking and markets bundlesReady rule sets for banks and market firms.Regulator bundleRBI 2026 cybersecurity Directions (DAKSH), SEBI CSCRF and SEBI BRSR Core.
Cyber and critical sectorsRule sets for cyber reporting, critical systems and power.Regulator bundleThe CERT-In 6-hour direction, NCIIPC critical information infrastructure and the CEA power sector cyber rules.
Identity, health and gamingRule sets for Aadhaar, health data and gaming.Regulator bundleUIDAI Aadhaar offline eKYC, the ABDM health information exchange and the MeitY online gaming rules.
Money, trade and sanctionsMoney-laundering, foreign exchange and sanctions rules.Regulator bundleFIU-IND suspicious transaction reporting, FEMA, FCRA, DGFT, STPI and SEZ, PNGRB and sanctions screening.